Cisco
Login
Search
Software Secure Workload
Activity Configure

Deploy Software Agents on Workloads Enforce Policies with Agents Recommended Windows OS-Based Policy Configuration Verify and Troubleshoot Policies with Windows OS-Based Filtering Attributes Policies Based on Application Name

Last updated: Jun 09, 2025

Policies Based on Application Name

Use the following information to verify and troubleshoot policies based on application name on Windows OS workloads.

The following sections describe the way policies should appear on the workload for an application binary entered as c:\test\putty.exe.

Sample Policy Based on Application Name

dst_ports {
start_port: 22
end_port: 22
consumer_filters {
application_name: “c:\test\putty.exe”
}
}}
ip_protocol: TCP
address_family: IPv4
inspection_point: EGRESS

Generated Firewall Rule

Generated Filter Using netsh

To verify, using native Windows tools, that a filter has been added to an advanced policy:

  • With administrative privileges, run cmd.exe.

  • Run netsh wfp show filters.

  • The output file, filters.xml, is generated in the current directory.

  • Check FWPM_CONDITION_ALE_APP_ID for the application name in the output file: filters.xml.

<fieldKey>FWPM_CONDITION_ALE_APP_ID</fieldKey>
                     <matchType>FWP_MATCH_EQUAL</matchType>
                     <conditionValue>
                            <type>FWP_BYTE_BLOB_TYPE</type>
                            <byteBlob>
                                   <data>
˓→5c006400650076006900630065005c0068006100720064006400690073006b0076006f006
˓→</data>
                                  <asString>\device\harddiskvolume2\temp\putty.exe</
˓→asString>
               </byteBlob>
       </conditionValue>

Generated WFP Filter Using tetenf.exe -l -f 

Filter Name:                   Secure Workload Rule 1
------------------------------------------------------
EffectiveWeight:               18446744073709551592
LayerKey:                      FWPM_LAYER_ALE_AUTH_CONNECT_V4
Action:                        Permit
RemoteIP:                      10.195.210.15-10.195.210.15
Remote Port:                   22
Protocol:                      6
AppID:                         \device\harddiskvolume2\test\putty.exe

Invalid Application Name

  • In WAF mode, Firewall rule is created for an invalid application name.

  • In WFP mode, the WFP filter is not created for an invalid application name but the NPC is not rejected. The agent logs a warning message and configures the rest of the policy rules.

Previous topic Verify and Troubleshoot Policies with Windows OS-Based Filtering Attributes Next topic Policies Based on Service Name